Upgrade path from 2.4.4720.3002 to latest?

[tedmolin]

Is it possible to upgrade directly from version 2.4.4720.3002 to latest 3.1.2103.0?

I followed the steps to upgrade to a new version and the services start but I can't run powershell commands or the mmc tools. It just says I need administrator permissions to ADFS. I have no problems running either the ADFS powershell cmdlets or the ADFS mmc.

In the end I had to downgrade and import old 2.4 config to get the service to respond successfully.

[redhook62]

Hi @tedmolin

are you talking about the latest version 3.1.2104.0 ?

Yes, in principle, it's possible to upgrade.

It will be necessary to check that all the new properties are well informed, then to make a save.
You can if it is not done look this https://github.com/neos-sdi/adfsmfa/wiki/03-UpgradeFromPrevious.

As indicated in the installation part.
The interactive user must be part of the "ADFS Delegate administrators" or of the "Local administrators" group of each ADFS server, these options must also be activated in the ADFS settings.

let us know !

regards

[tedmolin]

Hello @redhook62.

I was actually installning .2103 and not let latest .2104. I will make sure and try that one as well if there are known issues that could cause the problem I see with that version.

I'm on ADFS 4.0 on Server 2016. The adfs managed service account and the account I use for install and management have the permissions listed at https://github.com/neos-sdi/adfsmfa/wiki/01-Installation.

I followed the guide https://github.com/neos-sdi/adfsmfa/wiki/03-UpgradeFromPrevious when upgrading. Exporting configuration. Changing all the version numbers from 2.4.0.0 to 3.0.0.0 and saving to a new file and use that when starting up the new version on the same machine that was running the old version. I save configuration in ADDS and not SQL. Still I can't run any of the tools to actually check the configuration after the upgrade.

[redhook62]

Hi @tedmolin

I think you have done the necessary for the upgrade, the services start without problem it seems.
Be sure to check the messages in the eventlog !

As you can see in the version history, 3.1.2102.0 has been retired, there was indeed a problem with the rights regarding the execution of powershell commands and the console.

I recommend you to test the latest version 3.1.2104.0. (small changes since 3.1.2103.7
The numerous versions of the month of March made it possible to make this management of rights more reliable.

Can you verfity these points (summary of installation part) ?

• Framework .Net 4.7.2 installed
• Allow local system account for services administration Required (ADFS Configuration/Console)
• Allow local administrators group for services services (ADFS Configuration/Console)
• Enable delegation for service administration (Delegated Administration Group) (ADFS Configuration/Console)

Your MFA Administrators must belongs to the "local administrators group" (some cmdlets require this)
Your MFA Operators can belongs to the "ADFS delegation Administration Group" (Managin users and more)
For cmdlets see : PowerShell Commands

Being Domain administrator is not enough, you must belong to at least one of the 2 groups indicated to be able to administer MFA.

Then restart the "MFA Notification Hub" windows service and check the eventlog. The cache files will be cleaned (system.db and config.db)
Make sure you have opened the firewall rules (Set-MFAFirewallRules)

Then test, and if it still doesn't work, please send us the eventlog details about your problem.

regards

[tedmolin]

Must have been something in the version I first tried to install. Just upgraded to .2104.0 and did not have any issues starting the management tool or running the powershell cmdlets.

Thank you!

[redhook62]

Hi @tedmolin

happy, that your problem is solved, Yes, Yes, Yes !
If you have more questions, feel free to open another discussion.
Thank you again for using this component, do not hesitate to support and promote it

regards